Dueflow API

The Dueflow API is a JSON API over HTTPS at https://api.dueflow.co. Every endpoint is versioned under /v1.

curl https://api.dueflow.co/v1/organization \
  -H "Authorization: Bearer $DUEFLOW_TOKEN"

{
  "id": "fEeIwmrA0SHPFZ3pQnJjR",
  "name": "Phi Kappa Psi National",
  "type": "national",
  "parentId": null,
  "currency": "usd",
  "contactEmail": "nationals@example.org",
  "website": null,
  "logoUrl": null,
  "isActive": true,
  "createdAt": "2026-02-09T04:48:25.813Z",
  "updatedAt": "2026-07-25T17:37:35.482Z"
}

Start with Authentication to get a token, then Sync your roster for a worked end-to-end example.

What’s in v1

Area	Read	Write
Organization	`GET /organization`	—
Chapters (nationals)	`GET /chapters`, `GET /chapters/:id/members`	—
Members	`GET /members`, `GET /members/:id`	`POST /members`, `PATCH /members/:id`
Groups	`GET /groups`, `GET /groups/:id`	`POST /groups`, `PATCH /groups/:id`, add/remove members
Payments	`GET /payments`, `GET /payments/:id`	—
Reimbursements	`GET /reimbursements`, `GET /reimbursements/:id`	`POST /reimbursements/:id/review`
Reminders	`GET /reminders`, `GET /reminders/:id`	`POST /reminders/:id/send`
Activity	`GET /audit-logs`	—

Payments are read-only in v1: money movement stays in the dashboard, where it has the confirmation and approval flows an API call can’t reproduce.

What you can access

A token is bound to exactly one organization, and every response is scoped to it. A national organization can additionally read its direct child chapters with the chapters:read scope. Member responses deliberately exclude phone numbers, guardian and emergency contacts, custom fields and internal notes. Payment responses exclude payment-provider identifiers and raw provider payloads.

Conventions

Errors share one envelope with a stable error.code. See Errors.
Writes require an Idempotency-Key, so a retry can’t apply twice. See Idempotency.
Lists are cursor-paginated and support updatedSince. See Pagination and sync.
Every response carries an X-Request-Id. Include it when you contact support — it identifies the exact request in our logs.
Timestamps are RFC 3339 in UTC; monetary amounts are decimal strings ("50.00") with the organization’s currency, never floats.

Versioning

/v1 will not change in a way that breaks a working integration. Concretely, within v1 we will not remove an endpoint or a response field, add a required parameter, narrow an accepted value, or require a scope or role that your existing token doesn’t already hold. Every one of those is checked against the published description on each change to this API, so it can’t ship by accident. What we will do is add: new endpoints, new response fields, new optional parameters, new scopes. So parse responses leniently and ignore fields you don’t recognize. Anything genuinely incompatible goes in a /v2. If an endpoint is ever retired, it is marked deprecated in the description below and returns Deprecation and Sunset headers for at least 180 days before it stops answering. The machine-readable description of this version — the same one that generates this reference — is served by the API itself:

curl https://api.dueflow.co/v1/openapi.json

Getting started

Core concepts

Guides

What’s in v1

What you can access

Conventions

Versioning

​What’s in v1

​What you can access

​Conventions

​Versioning

What’s in v1

What you can access

Conventions

Versioning